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REINLVRKS 

Claims 1-20 are pending. Claims 1, 10, and 20 have been amended. 
Claims 3 and 12 have been canceled. Claims 1, 2, 4-11, and 13-20 remain in this • 
application. 

5 Pursuant to 37 CRR, 1.1 16Cb), Claims 1, 10, and 20 have been amended 

to present the claims in better form for consideration on appeal . Specifically, 
these claims have been amended to incorporate the limitations in now-canceled 
Claims 3 and 12. In addition, support for the amendments can be found in the 
specification on page 10, lines 3-13 and 18-23. No new matter has been 

10 introduced. Entry of the claim amendrnents is requested. 

Claims 1-20 again stand rejected under 35 U.S.C. § 103(a) as being 
obvious over U.S/ Patent No. 6,357,008, issued to Nachenberg (''Nachenberg*'), 
and further in view of U,S. Patent No. 6,314,425, issued to Serbinis et al 
('•Serbinis"). Applicant traverses the rejection. 

15 To establish a prima facie case of obviousness: (1 ) there must be some 

suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or 
combbie the reference teachings; (2) there must be a reasonable expectation of 
success; and (3) the combined references must teach or suggest all the claim 

20 limitations. MPEP § 2143. A prima facie case of obviousness has not been 
shown with respect to Claims 1,10, and 20. 

As previously argued, the Nachenberg patent discloses a method for 
detecting computer viruses through decryption, exploration and evaluation using 
emulation and artificial intelligence (Abstract; Col. 1, lines 16-20). During 

25 decryption, a sufficiait number of instructions ate emulated to allow an encrypted 
virus to decrypt the viral body of the encrypted vims (Col. 7, lines 3-5). During 
exploration^ all sections of code within a region likely to contain any virus are 
emulated (Col. 7, lines 9-11). During evaluation, any suspicious operations 
observed during the decryption and exploration phases are analyzed to determine 

30 whether the target program appears to be infected by a computer virus (Col 7, 
lines 17-20), Nachenberg also discloses static heuristic virus detection that 
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involves searching the instructions of a target program of instruction sequences 
that perform operations topically used by computer vimses (Col. 2, lines 39-45). 
By way of background, the Nachcnberg patent distinguishes over signature 
scanning antivirus programs thai can identify particular virus strains for removal 
5 and which may have a low "false-positive" rate (Col. 1 , lines 39-42). Only 

viruses whose signatures have already been determined and stored in a signature 
database may be detected using signature scanning (Col. 1 , lines 42-46). 

In contrast, the Serbinis reference discloses an apparatus and method for 
use of access tokens in an Internet document management system over open 

1 0 networks programmed to generate the access tokens and to provide a plurality of 
document management services (Abstract; Col 1, lines 11-14; CoL 5, lines 2-6), 
The document nlanagf^ent services include document storage and retrieval, 
collaborative file sharing, workflow services for electronic documents, an 
electronic document delivery service, and a document distribution service (Col. 5, 

15 lines 4-8). The Serbinis reference includes a relational database (Col. 6, lines 37- 
52), which utiliies a hierarchical storage schema (Col. 8, lines 12-24). Access to 
the system and services are controlled through the use of access tokens (Abstract). 
Each access token is a security code comprised of a signed string unique to a 
transaction and generated Srom one or more random numbers independent of any 

20 user information, resource information, or other identifiable information (Col. 5, 
lines 9-14). 

The required btu^en to prove a prima facie case of obviousness has not 
been shown. First, Nachenberg fails to provide a suggestion or motivation to 
combine with the reference teachings of Serbinis. In general, Nachenberg teaches 

25 a method for detecting computer viruses using a dynamic heuristic approach to 
detectitig viruses. Nachenberg also distinguishes over signature scanning anti- 
virus programs, but such reference fails to provide a suggestion or motivation to 
combine with Serbinis- While Nachenberg recognizes that virus signatures have 
ahxady been detemiincd are stored in a signature database, Serbinis teaches 

30 storing documents without teaching that such documents themselves concern 

virus data. Obviousness may not be established by picking and choosing fi-om an 
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art' reference only so much of the reference as will support a given position, to the 
exclusion of other part$ necessary to the full appreciation of what such reference 
fairly suggests to one of ordinary skil) in the art. Bousch & Lomb, Inc. v. Barnes- 
Hind, Inc., 796 F,2d 443, 2*30 USPQ 416 (Fed. Cir. 1986). Documents that might 
5 contain viruses are not the same as documents contaiaing infotmation about 
viruses, the latter of which is neither taught nor suggested by Serbinis. Thus, 
Serbinis' reference to scanning documents for viruses does not teach that storing 
documents is a necessary or desirable part of detecting viruses. Nor docs Serbinis 
teach or suggest the storing of virus signatures. As a result, one of ordinary skill 

1 0 in the art would not perceive any reason to combine the Internet-based document 
management system of Serbinis with the dynamic heuri stic virus detection 
method of Nachenberg. 

Second, one of ordinary skill in the art would not have a reasonable 
expectation of success in combining the teachings of Nachenberg and Serbinis, 

1 5 Nachenberg teaches a dynamic heuristic approach whose chief advantage is 

detecting new or previously-undiscovered viruses and distinguishes over signature 
scanning anti-virus programs that work by scanning files for signatures of known 
viruses, Serbinis, which is concemed with providing access tokens in an Internet- 
based document management system, discloses no form of vims detection. If 

20 Nachenberg were to be combined with Serbinis, the result would be a dynamic 
heuristic virus detection method, wherein records containing only virus 
identification information would be available over the Internet to selected usere 
possessing appropriate access tokens. Given that Nachenberg fails to teach or 
suggest maintaining vims information records, why or how such combination 

25 would be desirable or useful is speculative. 

Finally, even if combined, the Nachenberg and Serbinis references fail to 
teach or suggest all claim limitations. Finding similar elements in one or more 
references does not render an invention automatically unpatentable, and the 
invention itself may not be used as an instruction book on how to reconstruct the 

30 invention from the art references. See Panduit Corp, v. Dennison, Mfg. Co., 810 
F.2d 1561, 1 USPQ2d 1593 (Fed. Cir. 1987). 
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Initially, Nachcnberg is primarily concerned with detecting new or 
pre^'iously-undiscovered viruses. Accordingly, Nachenberg fails to teach or 
suggest such claim elements as a virus removal sentence comprising object code 
providing operations to clean the identified computer virus within a computer 
5 system or a virus removal sentence comprising object code providing operations 
to clean the identified computer vinis ftom the computer system, per Claims 1, 10 
and 20 (emphasis added). Similarly, Nachenberg fails to teach or suggest binary 
data encoding instructions to clean the computer virus from the computer system, 
wherein the instructions comprise the object code to clean the identified computer 

1 0 virus, per Claims 1,10 and 20 (emphasis added). Although Nachenberg indicates 
that '*a signature scanning antivirus program can identify particular virus strains 
for removal" (Col. 1, lines 39-40), Nachenberg fails to teach or suggest with any 
degree of specificity how the actual virus removal should be accomplished. 
Moreover, Nachenberg fails to teach or suggest comparing subsequently modified 

IS versions of the structured vims database to form a delta set of virus definition 
records and storing the delta virus definition records set into the structured virus 
database. Rather, Nachenberg merely states that when 'the antivirus main 

module 1 5 1 is set to scan a target program to determine heuristically whether 

or not the target program contains vims-like code, the main module 151 begins 

20 the decryption phase . . (Col. 7, lines 24-27). 

Similarly, Serbinis fails to teach or suggest converting vims definition 
records into a virus data file comprising vims definition sets or binary data 
encoding instmctions to detect the computer vims within a computer system, 
wherein the instmctions comprise the object code to detect the identified 

25 computer vims, per Claims 1, 10 and 20. Serbinis teaches that, if desired, 

documents can be scanned for vimses before being stored, but fails to teach or 
suggest a virus definition set or binary data encoding instmctions. Accordingly, 
all claim limitations are not found in Nachenberg and Serbinis, 

In view of the foregoing, no suggestion or motivation ^ists to combine 

30 the teachings of Nachenberg with those of Serbinis, there would be no expectation 
of success if the teachings were combined, and (3) the combined references fail to 
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teach or suggest all the claim limitations. Thus, a prima facie case of obviousness 
has not been shown with respect to Claims 1,10 and 20. 

Claims 3 and 1 2 have been canceled and no longer remain in tlie 
applications. Claims 2 and 4-9 are dependent on Claim 1 and are patentable for 
the above-stated reasons, and as further distinguished by the limitations recited 
therein. Claims 1 1 and 13-19 are dependent on Claim 10 and are patentable for 
the above-stated reasons, and as further distinguished by the limitations recited 
therein. As a prima facie case of obviousness has not b^n shown, withdrawal of 
the rejection of Claims 1*20 for obviousness under 35 U.S.C. 103(a) is requested. 

The prior art made of record and not relied upon has been reviewed by the 
applicant and is considered to be no more pertinent than the prior art references 
already applied. 

Claims 1, 2, 4-11, and 13-20 are believed to be in a condition for 
allowance. Withdrawal of the finality of the Office action and entry of the 
foregoing amendments is respectfully requested. A Notice of Allowance is 
eamestly solicited. Please contact the undersigned at (206) 381 -3900 regarding 
any questions or concerns associated with the present matter. 

RespectfiiUy submitted. 
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Dated! June 29> 2004 



Law Offices of Patrick J.S. Inouye 
810 Third Ave, Suite 258 
Seattle, WA 98104 



By: 




Patrick , 
Reg. No. 40,297' 



Esq. 



Telephone; (206) 381-3900 
Facsimile: (206)381-3999 
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